x_terminat_or_3
asked on
magic numbers
Hi all
I would like to know the magic numbers for Mac Os executables.
It is to be used in a PHP uploaded file validation tool.
The function only reads the first 20bytes of a file, so if the magic number is out of that range, it will not be possible for me to detect.
I would like to know the magic numbers for Mac Os executables.
It is to be used in a PHP uploaded file validation tool.
The function only reads the first 20bytes of a file, so if the magic number is out of that range, it will not be possible for me to detect.
ASKER
Well, maybe you could post the relevant parts of that file? I do not have possesion of Apple hardware
I'm pretty sure that the magic numbers file is common to many Unixes
(on Solaris, it is /etc/magic). The file is quite large (10,000 lines) and
contains entries for many non-Mac file formats. The Mac file formats
are scattered throughout it. I am sure you can find a version of the file
on a unix or linux system near you.
(on Solaris, it is /etc/magic). The file is quite large (10,000 lines) and
contains entries for many non-Mac file formats. The Mac file formats
are scattered throughout it. I am sure you can find a version of the file
on a unix or linux system near you.
ASKER
Yeah I do, I alraedy took the magic numbers for the ELF format. Do you mean that Mac also uses the ELF format?
No. Mac OS X uses Mach-O format and older Mac OS 9 (and some Carbon apps) use PEF (also know as CFM) format.
No version Mac OS will run ELF executables.
No version Mac OS will run ELF executables.
ASKER
so how about those magic numbers for Mach-O, and PEF?
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
ASKER
Thanks a lot,
Funny enough that information is not present in my magic file. (Fedora Core)
Funny enough that information is not present in my magic file. (Fedora Core)
The file contains numerous entries for the various Mac file formats.
For more information, see the man pages for 'magic' and 'file':
man 1 file
man 5 magic
One thing to keep in mind. Mac OS X uses the CMU Mach-O executable
file format. For some reason, Sun chose the same magic number for
Java Byte code that was already in use for multi-architecture (FAT) Mach-O
files, so additional checking must be performed. From a comment in
/usr/share/file/magic:
# Since Java bytecode and Mach-O fat-files have the same magic number the test
# must be preformed in the same "magic" sequence to get both right. The long
# at offset 4 in a fat file tells the number of architectures. The short at
# offset 4 in a Java bytecode file is the compiler minor version and the
# short at offset 6 is the compiler major version. Since there are only
# only 18 labeled Mach-O architectures at current, and the first released
# Java class format was version 43.0, we can safely choose any number
# between 18 and 39 to test the number of architectures against
# (and use as a hack).